Pyload-Ng Project Pyload-Ng vulnerabilities

CVE-2024-1240 CVE-2024-1240: An open redirection vulnerability exists in pyload/pyload version 0 An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which can be used for phishing or other malicious activities. The issue is fixed in pyload-ng 0.5.0b3.dev79.

CVE-2026-40071 [MEDIUM] CWE-285 pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions ### Summary Several WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute `MODIFY` operations that should be denied by pyLoad's own permission model. Confirmed mismatches: -

CVE-2026-46561 [MEDIUM] CWE-918 pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API ## Summary The SSRF mitigation added in commit `33c55da` for GHSA-7gvf-3w72-p2pg is incomplete. The `PREREQFUNCTION`-based private IP check was correctly applied to `HTTPChunk` (download path) but not to `HTTPRequest` (used by the `parse_urls` API). An authenticated attacker can supply a URL pointing to an attacker-controlled server that responds

CVE-2026-48737 [MEDIUM] CWE-918 pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs ## Summary `is_global_address` in [`src/pyload/core/utils/web/check.py`](https://github.com/pyload/pyload/blob/1b12dc7f348db8c144e0f39215680415e90ca4d2/src/pyload/core/utils/web/check.py) is the central guard against SSRF-style outbound connections in pyload-ng. It tests whether a given IP is "globall

CVE-2023-0488 [MEDIUM] CWE-79 CVE-2023-0488: Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42. Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.

CVE-2026-40594 [MEDIUM] CWE-346 CVE-2026-40594: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the set pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the set_session_cookie_secure before_request handler in src/pyload/webui/app/__init__.py reads the X-Forwarded-Proto header from any HTTP request without validating that the request originates from a trusted proxy, then mutates the global Flask configuration

CVE-2023-0057 [MEDIUM] CWE-1021 CVE-2023-0057: Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5 Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.

CVE-2024-24808 [MEDIUM] CWE-601 pyLoad open redirect vulnerability due to improper validation of the is_safe_url function pyLoad open redirect vulnerability due to improper validation of the is_safe_url function ### Summary Open redirect vulnerability due to incorrect validation of input values when redirecting users after login. ### Details pyload is validating URLs via the `get_redirect_url` function when redirecting users at login. The URL entered in the `next` variable goes through the `

CVE-2023-0055 [MEDIUM] CWE-319 Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32. The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session. This issue is patched in versio

CVE-2024-47821 [HIGH] CWE-78 pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API ### Summary The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved. A file ca